Unwired Adventures

Things to Do This Week-end With the Kids

Old Town Monrovia's Family Festival street fair - Winter Market, Friday Feb 2, 5 p.m. - 8 p.m. Street Fair and Certified Farmer's Market, with craft booths, kiddie rides, live music, food and family fun down the middle of Old Town's Myrtle Avenue. Free admission and always plenty of free parking. Myrtle Avenue at Olive Avenue. Tel: (626) 357-7442.

Family Adventures: Los Angeles County Arboretum, Saturday, Feb. 3, 2 p.m. Make a homemade paper Valentines and learn how paper was made long ago. Rain cancels. $20 per family. Registration: 626-821-4623. 301 N. Baldwin Ave, Arcadia. Map

Family Nature Walk, Eaton Canyon Nature Center, Every Saturday morning, weather permitting, from 9 a.m. to 11 a.m., A guided walk in Eaton Canyon Natural Area.  This is geared toward the family, including small children, and everyone is welcome.  Walking shoes, sunscreen, water, and a hat are recommended.  The walk is free to the public.  Meet in front of the building. Tel: (626) 398-5420

Pasadena Farmers Market, Saturday, February 3, 8:30 a.m. - 12:30 p.m., Fresh produce at reasonable prices for community residents. Every Tuesday from 9:00 AM - 1:00 PM at Villa Parke; Saturday from 8:30 AM - 12:30 PM at Victory Park, 2800 block of No. Sierra Madre Blvd between Paloma and Washington. Weekly, 8:30 AM - 12:30 PM/Sat, Tel: 626-795-4371, 626-449-0179. Map

Things to Do This Week-end With the Kids

Stories in the Afternoon: Norton Simon Museum, Sunday, Jan. 28, 2 p.m. Meet some shutterbugs and delve into the adventures of photographers through books. Then make a "Look, it's Me!" box based on images in the exhibition "The Collectible Moment." 411 W. Colorado Blvd., Pasadena Map

Caltech Dabney Lounge, Friday and Saturday, January 26 and 27th at 8:00 PM, Caltech students will begin a three-concert Chamber Music Weekend with a variety of trios by Haydn, Beethoven, and Milhaud, and Schubert's "Trout" Quintet. A free reception for all will follow the concert. FREE; no tickets or reservations required

Pacific Asia Museum Free Day, Friday, January 26,  10 a.m. - 8 p.m., Pacific Asia Museum is free to the public the fourth Friday of every month, 46 N Los Robles AVE, Pasadena CA  91105 626-449-2742 Map

Angel Frames at the Armory Center for the Arts: Saturday, January 27, 8 a.m. - 6 p.m., A Collection of Very Special Art by the Children of Villa Esperanza, Villa Esperanza Services is a non-profit organization devoted to the care and education of a diverse, disabled population of children, adults and senior citizens. Founded by a group of mothers who believed their developmentally disabled children deserved quality care and education. Call 626-449-2919 Map

Riverside California Municipal Wifi

Another municipal wireless network:

"Call it a municipal status symbol, but when Phase I of a three-phase rollout becomes available in early February 2007, the City of Riverside will blanket its entire 86 square miles with free wireless Internet network, giving the City an entirely new identity as one of the most wired - or unwired - municipalities in the state of California.

Access points will be placed at the rate of 30-35 per square mile with each having a range of approximately 1,000 feet depending on topography. The City will transform all of its 86 square miles into WI-FI hot spots by installing more than 1,000 cell points on street lights, traffic signals, and City facilities.

Riverside's WI-FI project is designed to benefit local merchants looking to attract residents who eat or shop anywhere in the City and still want access to e-mail, work projects or the Internet."

Press release here.
More from muniwireless.com

Path MTU Discovery and Filtering ICMP

I'm posting this for historical purposes. It's disappeared from it's original location. There was a time I would reference it:

Path MTU Discovery and Filtering ICMP
Marc Slemko <marcs@znep.com>
Created: Thursday, January 18 1998
Last Modified:

---

This document explains the details of how path MTU discovery (PMTU-D) combined with filtering ICMP messages can result in connectivity problems.  If you are familiar with the terms discussed

Let's start by defining what we are talking about

MTU

   

The maximum transmission unit is a link layer restriction on the maximum number of bytes of data in a single transmission (ie. frame, cell, packet, depending on the terminology).  The below table shows some typical values for MTUs, taken from RFC-1191:

MTU	Where Commonly Used
65535	Hyperchannel
17914	16 Mbit/sec token ring
8166	Token Bus (IEEE 802.4)
4464	4 Mbit/sec token ring (IEEE 802.5)
1500	Ethernet
1500	PPP (typical; can vary widely)
576	X.25 Networks

Path MTU

   

The smallest MTU of any link on the current path between two hosts.  This may change over time since the route between two hosts, especially on the Internet, may change over time.  It is not necessarily symmetric and can even vary for different types of traffic from the same host.

Fragmentation

   

When a packet is too large to be sent across a link as a single unit, a router can fragment the packet.  This means that it splits it into multiple parts which contain enough information for the receiver to glue them together again.  Note that this is not done on a hop-by-hop basis, but once fragmented a packet will not be put back together until it reaches its destination.  Fragmentation is undesirable for numerous reasons, including:

• If any one fragment from a packet is dropped, the entire     packet needs to be retransmitted.  This is a very significant     problem.
• It imposes extra processing load on the routers that have     to split the packets.
• In some configuration, simpler firewalls will block all     fragments because they don't contain the header information     for a higher layer protocol (eg. TCP) needed for filtering.

DF (Don't Fragment) bit

   

This is a bit in the IP header that can be set to indicate that the packet should not be fragmented by routers, but instead an ICMP "can't fragment" error is returned sent to the sender and the packet is dropped.

ICMP Can't Fragment Error

   

This error (type 3 (destination unreachable), code 4     (fragmentation needed but don't-fragment bit set)) is returned by     a router when it receives a packet that is too large for it to     forward and the DF bit is set.  The packet is dropped and the     ICMP error is sent back to the origin host.  Normally, this tells     the origin host that it needs to reduce the size of its packets     if it wants to get through.  Recent systems also include the MTU of     the next hop in the ICMP message so the source knows how big its     packets can be.  Note that this error is only sent if the DF bit is set;     otherwise, packets are just fragmented and passed through.

MSS

   

The MSS is the maximum segment size.  It can be announced during     the establishment of a TCP connection to indicate to the other end     the largest amount of data in one packet that should be sent by     the remote system.  Normally the packet generated will be 40 bytes     larger than this; 20 bytes for the IP header and 20 for the TCP header.     Most systems announce a MSS that is determined from the MTU on     the interface that the traffic to the remote system passes out     from the system through.

Path MTU Discovery (PMTU-D)

   

Now you know that Path MTUs vary.  You know that     fragmentation is bad.  The solution?  Well, one solution is     Path MTU Discovery.  The idea behind it is to send packets that     are as large as possible while still avoiding fragmentation.     A host does this by starting by sending packets that have     a maximum size of the lesser of the local MTU or the MSS announced     by the remote system.  These packets are sent with the DF bit set.     If there is some MTU between the two hosts which is too small to     pass the packet successfully, then an ICMP can't fragment error     will be sent back to the source.  It will then know to lower the     size; if the ICMP message includes the next hop MTU, it can pick     the correct size for that link immediately, otherwise it has to     guess.     

The exact process that systems go through is somewhat     more complicated to account for special circumstances.  For     full details, see     RFC-1191.    

A good indication of if a system is trying to do PMTU-D is to     watch the packets it is sending with something like tcpdump or     snoop and see if they have the DF bit set; if so, it is most likely     trying to do PMTU-D.

Now, to the problem with ICMP filtering and PMTU-D

Now we get to the problem.  Many network administrators have decided to filter ICMP at a router or firewall.  There are valid (and many invalid) reasons for doing this, however it can cause problems.  ICMP is an integral part of the Internet and can not be filtered without due consideration for the effects.

In this case, if the ICMP can't fragment errors can not get back to the source host due to a filter, the host will never know that the packets it is sending are too large.  This means it will keep trying to send the same large packet, and it will keep being dropped--silently dropped from the view of any system on the other side of the filter.  While a small handful of systems that implement PMTU-D also implement a way to detect such situations, most don't and even for those that do it has a negative impact on performance and the network. 

If this is happening, typical symptoms include the ability for small packets (eg. request a very small web page) to get through, but larger ones (eg. a large web page) will simply hang.  This situation can be confusing to the novice administrator because they obviously have some connectivity to the host, but it just stops working for no obvious reason on certain transfers.

There is one solution, and several workarounds, for this problem.  They include:

• Fix your filters!  The real problem here is filtering ICMP messages without understanding the consequences.  Many packet filters will allow you to setup filters to only allow certain types of ICMP messages through. If you reconfigure them to let ICMP can't fragment (type 3, code 4) messages through, the problem should disappear.  If the filter is somewhere between you and the other end, contact the administrator of that machine and try to convince them to fix the problem.
• Reduce the MTU on the machines at one end or the other.  This is a workaround and should not be done unless necessary.  If you reduce the MTU on the system trying to do path MTU discovery to a point where it is less than or equal to the former path MTU, it will no longer try sending packets large enough to cause problems. Similarly, if you change the MTU on the system on the other end, it will advertise a lower MSS so the sending system will only send packets with data that fits into that MSS.
• Disable PMTU-D; if you control access to the machine that is trying to do PMTU-D, and are unable to get the person administering the bogus filter to fix it, disabling PMTU-D will fix the problem for data sent by that machine.  Data being received by the machine, however, can still run into the problem.  With the size that HTTP requests are growing to, this could start to be a problem more and more; historically, HTTP requests have nearly always been small enough to fit through links with small MTUs in one packet.  Disabling PMTU-D is simply a workaround, and should not generally be done unless necessary or you know what you are doing.

So how can using RFC 1918 addresses for router links cause problems?

On many routers, a separate IP address in the same subnet is required for each end of a point to point link.  This can use address space if there are a large number of such links.  Since the actual address of the links doesn't appear to impact much, many people use RFC 1918 private address space for such links.  The blocks included in this are:

10.0.0.0        -   10.255.255.255  (10/8 prefix)

172.16.0.0      -   172.31.255.255  (172.16/12 prefix)

192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

If you are using such addresses, then ICMP messages (including "can't fragment" errors) will normally be generated using such addresses.  Since many networks filter incoming traffic from such reserved addresses, the net result is the same as if all ICMP were being filtered and can cause the same problems.

Things to Do This Week-end With the Kids

Shark Business: CalTech Beckman Auditorium, Saturday, Jan. 20, 2 p.m. This film unravels some of the mysteries surrounding sharks with controversial behaviorist Dr. Erich Ritter. You'll witness divers testing the limits of shark-human interaction outside of cages with dangerous sharks such as lemon, bull and even great white. Rachel Berquist of Caltech's Mechanical Engineering Deparment will introduce the film and guide the post-screening discussion. $5. 332 S. Michigan Ave., Pasadena. Map

Family Day: Norton Simon Museum, Saturday, Jan. 20, 1 p.m. Explore the world of sound and music in Hindu sculpture, then create your own special musical instrument. Free with museum admission. 411 W. Colorado Blvd., Pasadena. Map

Musical Circus: Pasadena Symphony, Saturday, Jan. 20, 8:30 a.m. Children can hold and "play" orchestral instruments, then enjoy a concert for kids by "Homespun," featuring storyteller Leslie Perry, musician Robert Hilton and blues singer Brother Yusef. Pasadena Civic Auditorium, 300 E. Green St., Pasadena. Map

A Kids Life: Haugh Performing Arts Center, Citrus College, Saturday, 1:30 and 3:30 p.m. Meet Zach, a fun-loving 5-year-old and his big dog Starsky. They explore their hometown, make new friends, and learn lessons about life along the way in these two musical performances specifically designed for children in grades K-5. $6. 1000 W. Foothill Blvd., Glendora. Map

Tales In A Ten Gallon Hat: Monrovia Public Library, Saturday, Jan. 20, 11:00 a.m. and 2 p.m. Saddle up your horse and ride on over to the library as we enjoy the Wild West through stories, songs, and more! For school-aged children (K-5th).

Family Picnic Sundays: L.A. County Arboretum, Sunday, Jan. 21, 10 a.m, Family Picnic Sundays! Come explore The Arboretum Library, (open 10 a.m. to 1 p.m.) and our great story trees! Enjoy plant & nature stories and a make & take craft. 626-821-3222 $7 adults, $5 seniors, students; $2.50 ages 5-12. Map

ipwfadm script for Cable Modem or DSL

Originally posted December 30th 1998 on my old website. Today it would have been considered a blog. Does that mean that I've been blogging almost 10 years?

Original location:
http://www.pasadena.net/linux/linuxsecure.html

#!/bin/sh
#
# My ipfwadm rules on a Cable Modem
#
#
# Use at your own risk!

# My external ip address:
#

EXTIP="169.254.2.2/32"

#
# Misc. startup:
#
echo "1" > /proc/sys/net/ipv4/ip_forward
sbin/depmod -a
/sbin/modprobe ip_masq_ftp.o
/sbin/modprobe ip_masq_raudio.o
#
# Flush rules:
#
ipfwadm -I -f
ipfwadm -O -f
ipfwadm -F -f
#
# Set default to deny:
#
ipfwadm -F -p deny
ipfwadm -I -p deny
ipfwadm -O -p deny
#
# Allow masquerading from my internal network:
#
/sbin/ipfwadm -F -a m -S 172.30.30.0/24 -D 0.0.0.0/0
# -----------------------
# EXTERNAL INBOUND RULES:
# -----------------------
#
# Deny packets with localhost, broadcast and multicast addresses:
#
ipfwadm -I -a deny -Weth0 -S 224.0.0.0/3 -D $EXTIP -o
ipfwadm -I -a deny -Weth0 -S 127.0.0.0/8 -D $EXTIP -o
ipfwadm -I -a deny -Weth0 -S 255.0.0.0/8 -D $EXTIP -o
#
# Deny rfc 1918 addresses:
#
ipfwadm -I -a deny -Weth0 -S 10.0.0.0/8 -D $EXTIP -o
ipfwadm -I -a deny -Weth0 -S 172.16.0.0/12 -D $EXTIP -o
ipfwadm -I -a deny -Weth0 -S 192.168.0.0/16 -D $EXTIP -o
#
# Deny packets without ip address.
#
ipfwadm -I -a deny -Weth0 -S 0.0.0.0/32 -D $EXTIP -o
#
# Prevent spoofing. Deny incoming packets that have 
# our external address:
ipfwadm -I -a deny -Weth0 -S $EXTIP -o
#
# Allow only specific ICMP:
#
# http://www.iana.org/assignments/icmp-parameters
# http://www.pasadena.net/cisco/mtu.html
#
ipfwadm -I -a accept -Weth0 -S any/0 3 4 11 -P icmp
#
# Allow only ACKed tcp packets to our network:
#
ipfwadm -I -a accept -Weth0 -S any/0 -D $EXTIP 1024:65535 -P tcp -k
#
# For ftp clients:
#
ipfwadm -I -a accept -Weth0 -S any/0 20 -D $EXTIP 1024:65535 -P tcp
#
# Allow telnet and ssh from this network:
#
ipfwadm -I -a accept -Weth0 -S 196.254.92.0/24 -D $EXTIP 22 23 -P tcp
#
# Allow inbound DNS queries on our server:
#
ipfwadm -I -a accept -Weth0 -S any/0 -D $EXTIP 53 -P udp
#
# Allow outbound DNS queries:
#
ipfwadm -I -a accept -Weth0 -S any/0 53 -D $EXTIP 1024:65535 -P udp
#
# Important!! Deny and log anything else:
#
ipfwadm -I -a deny -Weth0 -S any/0 -D any/0 -o
#
# -----------------------
# EXTERNAL OUTBOUND RULES:
# -----------------------
#
# Prevent leakage of rfc 1918 addresses:
#
ipfwadm -O -a deny -Weth0 -S 10.0.0.0/8 -o
ipfwadm -O -a deny -Weth0 -S 172.16.0.0/12 -o
ipfwadm -O -a deny -Weth0 -S 192.168.0.0/16 -o
ipfwadm -O -a deny -Weth0 -D 10.0.0.0/255.0.0.0 -o
ipfwadm -O -a deny -Weth0 -D 172.16.0.0/255.240.0.0 -o
ipfwadm -O -a deny -Weth0 -D 192.168.0.0/255.255.0.0 -o
#
# Allow everything else:
#
ipfwadm -O -a accept -Weth0 -S any/0
#
# Deny and log anything else:
#
ipfwadm -O -a deny -Weth0 -S any/0 -o
# -----
# Misc:
# -----
#
# Allow localhost:
#
ipfwadm -I -a accept -Wlo -S any/0 -D any/0
ipfwadm -O -a accept -Wlo -S any/0 -D any/0
#
# Allow everything on the internal network:
#
ipfwadm -I -a accept -Weth1 -S any/0 -D any/0
ipfwadm -O -a accept -Weth1 -S any/0 -D any/0
#
# End of script.

 

---

More Free Wi-Fi in LA (Who Knew There Was Free Wi-Fi in LA?)

Los Angeles expands public Wi-Fi network found at Muniwireless:

"Expect a growth spurt from Los Angeles’ free public wireless Internet service in 2007.

Yesterday, the Board of Commissioners of the Community Redevelopment Agency of the City of Los Angeles (CRA/LA), the public agency charged with revitalizing the city’s downtown, announced $225,000 in contract extensions and enhancements to build out the network to four additional city districts. The service currently provides access in Pershing Square. Plans call for extending it to the financial district and historic core, Bunker Hill and Little Tokyo...."  More Here

Related links:
Wireless Weblog
Broadband Reports
JoVoGo Communications

Things to Do This Week-end With the Kids

Old Town Monrovia's Family Festival street fair - Winter Market, 5 p.m. - 8 p.m., Friday January 12th, Street Fair and Certified Farmer's Market, with craft booths, kiddie rides, live music, food and family fun down the middle of Old Town's Myrtle Avenue. Free admission and always plenty of free parking. (626) 357-7442

Silly Spyglass, Lakeshore Learning Store, 11 a.m. - 3 p.m. Saturday January 13th, Children make colorful play telescopes and peek through them. 3848 E. Foothill Blvd., Pasadena

Chinese New Year, Lamanda Park Branch Library, 3 p.m. Sunday January 14th, Stories, crafts, special treats - celebrating the Year of the Pig! You'll be all ready for Chinese New Year on the 29th. 140 S. Altadena Dr., Pasadena

King Birthday Party, Kidspace Children's Museum 10 a.m. - 3 p.m. Monday January 15th, A cultural festival celebrating the words and ideas of Martin Luther King, Jr. Explore Dr. King's life through presentations on his life and on the time in which he lived, plus performing arts honoring Dr. King's legacy of tolerance, peace, and equality. Brookside Park, 480 N. Arroyo Blvd., Pasadena

Junie B. Jones Party: La Pintoresca Branch Library 3:30 p.m. - 4:30 pm. Tuesday January 16th, A party honoring our favorite first grader--Junie B. Jones. There will be a little Junie B. Bingo, some Junie B. stories and some of her favorite treats. Registration is required. (626) 744-7268. 1355 N. Raymond Ave., Pasdena.